@astram/identity 0.16.0 → 0.17.0

package/dist/features/service-account/service-account.service.js

@@ -24,6 +24,7 @@ exports.ceilingAllowsRole = ceilingAllowsRole;
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@astram/core");
 const engine_1 = require("@astram/engine");
+const role_binding_js_1 = require("../authz/role-binding.js");
 /** The account id was not in the caller's subtree (unknown or cross-tenant) → 404 (no leak). */
 class ServiceAccountNotFoundError extends Error {
     constructor() {
@@ -285,20 +286,48 @@ class ServiceAccountService {
             nodes: (ids) => ids.map((id) => nodeName.get(id) ?? DELETED_NODE),
         };
     }
+    /**
+     * G-013 (spec §5.D, R2): every requested role is OWNED by the account's company — another
+     * company's role, an ownerless role or an unknown id is a 400 with one fixed message (no name, no
+     * id: the role catalog read is not caller-scoped). Applies to every admin, root included, and runs
+     * BEFORE the ceiling. Store errors propagate (→ 503).
+     */
+    /** The ids among `roleIds` owned by `companyUuid` (G-013), in their order. Store errors propagate. */
+    async ownedBy(roleIds, companyUuid) {
+        if (roleIds.length === 0)
+            return [];
+        const owners = new Map((await this.accounts.roleOwners(roleIds)).map((r) => [ceilingKey(r.id), r.owner]));
+        const company = ceilingKey(companyUuid);
+        return roleIds.filter((id) => {
+            const owner = owners.get(ceilingKey(id));
+            return typeof owner === 'string' && ceilingKey(owner) === company;
+        });
+    }
+    async assertRolesOwnedBy(roleIds, companyUuid) {
+        if (roleIds.length === 0)
+            return;
+        const owners = new Map((await this.accounts.roleOwners(roleIds)).map((r) => [ceilingKey(r.id), r.owner]));
+        const company = ceilingKey(companyUuid);
+        for (const id of roleIds) {
+            const owner = owners.get(ceilingKey(id));
+            if (owner === undefined || owner === null || ceilingKey(owner) !== company) {
+                throw new ServiceAccountInputError(role_binding_js_1.ROLE_NOT_IN_COMPANY);
+            }
+        }
+    }
     /**
      * What the caller may grant (the picker source for create/edit), computed from the SAME
-     * {@link ceilingOf} the write check enforces. Root → every role + every company; non-root → the
-     * roles they hold + the nodes of their reachable subtree. Nodes come back tree-ordered with a
-     * `parentId` only when the parent is also assignable.
+     * {@link ceilingOf} the write check enforces. Roles: only those OWNED by the company a new agent
+     * is created in (the admin's tenant, G-013) — root gets all of them, a non-root admin those it
+     * also holds. Companies: root every company; non-root the nodes of its reachable subtree. Nodes
+     * come back tree-ordered with a `parentId` only when the parent is also assignable.
      */
     async assignable(admin) {
         const ceiling = await this.ceilingFor(admin);
-        const [roles, nodes] = ceiling.isRoot
-            ? await Promise.all([this.accounts.allRoles(), this.accounts.allNodes()])
-            : await Promise.all([
-                this.accounts.rolesByIds([...ceiling.roleIds]),
-                this.accounts.nodesByIds([...ceiling.nodeIds]),
-            ]);
+        const [roles, nodes] = await Promise.all([
+            this.accounts.rolesOwnedBy(admin.tenantId),
+            ceiling.isRoot ? this.accounts.allNodes() : this.accounts.nodesByIds([...ceiling.nodeIds]),
+        ]);
         return {
             // Defensive re-filter through the same predicates (a store that over-returns can't widen it).
             roles: roles
@@ -337,6 +366,8 @@ class ServiceAccountService {
                 ? uniqueIds(admin.scopeSubtreeNodeIds)
                 : [admin.tenantId];
         const roleIds = requestIds(input.roleIds ?? [], 'roleIds');
+        // G-013: the agent is created in the admin's tenant, so its roles must be that company's own.
+        await this.assertRolesOwnedBy(roleIds, admin.tenantId);
         await this.assertWithinCeiling(await this.ceilingFor(admin), scopeSubtree, roleIds);
         const id = (0, node_crypto_1.randomUUID)();
         const createdAtMs = this.now();
@@ -399,6 +430,11 @@ class ServiceAccountService {
         const existing = await this.accounts.getById(id, scopeOf(admin));
         if (existing === null)
             throw new ServiceAccountNotFoundError();
+        // G-013: every REQUESTED role is the account's company's own (400, every admin), before the
+        // ceiling. Preserved out-of-ceiling roles come from the stored row and are not re-judged.
+        if (requestedRoles !== undefined) {
+            await this.assertRolesOwnedBy(requestedRoles, existing.tenantId);
+        }
         // Re-check the ceiling for whatever is REQUESTED (an edit can't escalate either).
         const ceiling = await this.ceilingFor(admin);
         await this.assertWithinCeiling(ceiling, requestedScope ?? [], requestedRoles ?? [], {
@@ -410,8 +446,10 @@ class ServiceAccountService {
         const preservedScope = requestedScope !== undefined && !ceiling.isRoot
             ? existing.scopeSubtreeNodeIds.filter((n) => !ceilingAllowsNode(ceiling, n))
             : [];
+        // G-013: a preserved role must still be owned by the agent's company; one that is not (e.g. its
+        // company was deleted, leaving it ownerless) is dropped, never carried forward.
         const preservedRoles = requestedRoles !== undefined && !ceiling.isRoot
-            ? existing.roleIds.filter((r) => !ceilingAllowsRole(ceiling, r))
+            ? await this.ownedBy(existing.roleIds.filter((r) => !ceilingAllowsRole(ceiling, r)), existing.tenantId)
             : [];
         // Strictly after the row's last edit, so two edits in the same millisecond still differ and the
         // optimistic guard below can tell them apart.

package/dist/features/service-account/service-account.store.d.ts

@@ -60,7 +60,17 @@ export declare class ServiceAccountStore {
     constructor(pool: Pool, schemas?: IdentitySchemaNames);
     /** Roles by id (unknown ids are simply absent — the caller supplies a fallback label). */
     rolesByIds(ids: readonly string[]): Promise<RoleOption[]>;
-    /** Every role in the catalog (ROOT's assignable set). */
+    /**
+     * G-013: the owner company of each role id that exists (`null` = ownerless legacy row). Unknown ids
+     * are absent. The ids come back as STORED (the caller compares with `sameUuid`).
+     */
+    roleOwners(ids: readonly string[]): Promise<Array<{
+        id: string;
+        owner: string | null;
+    }>>;
+    /** G-013: the roles OWNED by one company (an agent of that company may hold only these). */
+    rolesOwnedBy(companyUuid: string): Promise<RoleOption[]>;
+    /** Every role in the catalog. */
     allRoles(): Promise<RoleOption[]>;
     /** Companies (scope nodes) by id, with their parent handle. Unknown ids are absent. */
     nodesByIds(ids: readonly string[]): Promise<ScopeNodeOption[]>;

package/dist/features/service-account/service-account.store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B;;;;OAIG;gBAEgB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAO3E,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D,yDAAyD;IACnD,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}
+{"version":3,"file":"service-account.store.d.ts","sourceRoot":"","sources":["../../../src/features/service-account/service-account.store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAA2B,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,+FAA+F;AAC/F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAUD,kGAAkG;AAClG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AA2DD,kGAAkG;AAClG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAOD,qBAAa,mBAAmB;IAO5B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAP1B;;;;OAIG;gBAEgB,IAAI,EAAE,IAAI,EACV,OAAO,GAAE,mBAA+C;IAO3E,0FAA0F;IACpF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAU/D;;;OAGG;IACG,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAa9F,4FAA4F;IACtF,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAQ9D,iCAAiC;IAC3B,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAQvC,uFAAuF;IACjF,UAAU,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAUpE,kEAAkE;IAC5D,QAAQ,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;IAQ5C;;;;;OAKG;IACG,WAAW,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAwBjF,2EAA2E;IACrE,IAAI,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAS7D,kGAAkG;IAC5F,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IASjF;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE;QAClB,EAAE,EAAE,MAAM,CAAC;QACX,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;QACvC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;KACrB,GAAG,OAAO,CAAC,IAAI,CAAC;IAmBjB;;;;OAIG;IACG,MAAM,CACV,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,EACnB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,mBAAmB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QACxC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EACD,WAAW,EAAE,MAAM;IACnB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,GAAG,IAAI,GAClC,OAAO,CAAC,MAAM,CAAC;CAgCnB"}

package/dist/features/service-account/service-account.store.js

@@ -72,7 +72,26 @@ class ServiceAccountStore {
         const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid IN (${u.map(() => '?').join(', ')}) ORDER BY r_name`, u));
         return rows.map((r) => ({ id: r.id, name: r.name }));
     }
-    /** Every role in the catalog (ROOT's assignable set). */
+    /**
+     * G-013: the owner company of each role id that exists (`null` = ownerless legacy row). Unknown ids
+     * are absent. The ids come back as STORED (the caller compares with `sameUuid`).
+     */
+    async roleOwners(ids) {
+        const u = uniqueIds(ids);
+        if (u.length === 0)
+            return [];
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_owner_company_uuid AS owner FROM \`${this.schemas.app}\`.\`roles\` WHERE r_uuid IN (${u.map(() => '?').join(', ')})`, u));
+        return rows.map((r) => ({
+            id: r.id,
+            owner: typeof r.owner === 'string' && r.owner.length > 0 ? r.owner : null,
+        }));
+    }
+    /** G-013: the roles OWNED by one company (an agent of that company may hold only these). */
+    async rolesOwnedBy(companyUuid) {
+        const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${this.schemas.app}\`.\`roles\` WHERE r_owner_company_uuid = ? ORDER BY r_name`, [companyUuid]));
+        return rows.map((r) => ({ id: r.id, name: r.name }));
+    }
+    /** Every role in the catalog. */
     async allRoles() {
         const rows = (await this.pool.query(`SELECT r_uuid AS id, r_name AS name FROM \`${this.schemas.app}\`.\`roles\` ORDER BY r_name`, []));
         return rows.map((r) => ({ id: r.id, name: r.name }));

package/dist/features/user/signin-admin.tokens.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Auth capabilities R11 (task 18): module-internal DI tokens for the admin sign-in controls and the
+ * users list's `mfaStatus` (built in `IdentityFeatureModule.forRoot`). Not exported from the package.
+ */
+/** The `MfaResetter` (guard's `MariaDbMfaResetter` over identity's runtime pool). */
+export declare const IDENTITY_MFA_RESETTER: unique symbol;
+/** The autocommit audit writer for `auth.unlocked_by_admin` / `auth.sessions_ended`. */
+export declare const IDENTITY_SIGNIN_ADMIN_AUDIT: unique symbol;
+/** The batched `mfaStatus` reader (`null` when nothing can answer). */
+export declare const IDENTITY_MFA_STATUS_READER: unique symbol;
+//# sourceMappingURL=signin-admin.tokens.d.ts.map

package/dist/features/user/signin-admin.tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signin-admin.tokens.d.ts","sourceRoot":"","sources":["../../../src/features/user/signin-admin.tokens.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,eAAkC,CAAC;AACrE,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,eAAwC,CAAC;AACjF,uEAAuE;AACvE,eAAO,MAAM,0BAA0B,eAAuC,CAAC"}

package/dist/features/user/signin-admin.tokens.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IDENTITY_MFA_STATUS_READER = exports.IDENTITY_SIGNIN_ADMIN_AUDIT = exports.IDENTITY_MFA_RESETTER = void 0;
+/**
+ * Auth capabilities R11 (task 18): module-internal DI tokens for the admin sign-in controls and the
+ * users list's `mfaStatus` (built in `IdentityFeatureModule.forRoot`). Not exported from the package.
+ */
+/** The `MfaResetter` (guard's `MariaDbMfaResetter` over identity's runtime pool). */
+exports.IDENTITY_MFA_RESETTER = Symbol('IDENTITY_MFA_RESETTER');
+/** The autocommit audit writer for `auth.unlocked_by_admin` / `auth.sessions_ended`. */
+exports.IDENTITY_SIGNIN_ADMIN_AUDIT = Symbol('IDENTITY_SIGNIN_ADMIN_AUDIT');
+/** The batched `mfaStatus` reader (`null` when nothing can answer). */
+exports.IDENTITY_MFA_STATUS_READER = Symbol('IDENTITY_MFA_STATUS_READER');

package/dist/features/user/user-mfa-status.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Auth capabilities R11.3 (task 18, AC-17): the `mfaStatus` of a page of users for
+ * `GET /identity/users[/:uuid]` — `enrolled` | `required` | `grace` | `not_required`, never device
+ * names, secrets or counts.
+ *
+ * Batched per page: ONE active-membership read here (`?`-bound `IN` list over the runtime pool), then
+ * ONE call to guard's `MfaRequirementService.statusesFor` (core `evaluateMfaRequirement`; its own
+ * reads are batched too, see there). Root accounts (the `rootIds` allowlist) are flagged so only
+ * the platform floor applies to them (D-11).
+ *
+ * Without the policy feature (guard's service `null`): `enrolled` when a confirmed device exists,
+ * else `not_required`, from ONE batched device read. Nothing wired at all ⇒ no reader (rows carry
+ * no `mfaStatus`). Errors propagate; `UserService` answers 503 (never a guessed status).
+ */
+import type { MfaAdminStatus, MfaStatusSubject } from '@astram/guard/internal';
+export type UserMfaStatus = MfaAdminStatus;
+export interface UserMfaStatusReader {
+    statusesOf(userIds: readonly string[]): Promise<ReadonlyMap<string, UserMfaStatus>>;
+}
+export interface UserMfaStatusDeps {
+    /** A query on identity's runtime pool. */
+    readonly query: (sql: string, params?: unknown[]) => Promise<unknown>;
+    readonly schemas: {
+        readonly app: string;
+    };
+    readonly rootIds: readonly string[];
+    /** Guard's mandatory-2FA service (`SHIELD_MFA_REQUIREMENT`); `null` when the feature is off. */
+    readonly service: {
+        statusesFor(subjects: readonly MfaStatusSubject[]): Promise<ReadonlyMap<string, MfaAdminStatus>>;
+    } | null;
+    /** Guard's MariaDB source (`SHIELD_MFA_REQUIREMENT_SOURCE`), for the no-feature fallback. */
+    readonly devices: {
+        confirmedFactorsOf(principalIds: readonly string[]): Promise<ReadonlySet<string>>;
+    } | null;
+}
+/** The reader, or `null` when nothing that can answer is wired. */
+export declare function createUserMfaStatusReader(deps: UserMfaStatusDeps): UserMfaStatusReader | null;
+//# sourceMappingURL=user-mfa-status.d.ts.map

package/dist/features/user/user-mfa-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-mfa-status.d.ts","sourceRoot":"","sources":["../../../src/features/user/user-mfa-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG/E,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC;AAE3C,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;CACrF;AAED,MAAM,WAAW,iBAAiB;IAChC,0CAA0C;IAC1C,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACtE,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,gGAAgG;IAChG,QAAQ,CAAC,OAAO,EAAE;QAChB,WAAW,CACT,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GACpC,OAAO,CAAC,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;KACjD,GAAG,IAAI,CAAC;IACT,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE;QAChB,kBAAkB,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;KACnF,GAAG,IAAI,CAAC;CACV;AAED,mEAAmE;AACnE,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,iBAAiB,GAAG,mBAAmB,GAAG,IAAI,CA0C7F"}

package/dist/features/user/user-mfa-status.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUserMfaStatusReader = createUserMfaStatusReader;
+const http_js_1 = require("../shared/http.js");
+/** The reader, or `null` when nothing that can answer is wired. */
+function createUserMfaStatusReader(deps) {
+    const { service, devices } = deps;
+    if (service) {
+        const table = `\`${deps.schemas.app}\`.\`company_membership\``;
+        return {
+            async statusesOf(userIds) {
+                const ids = [...new Set(userIds.filter((i) => typeof i === 'string' && i.length > 0))];
+                if (ids.length === 0)
+                    return new Map();
+                const rows = (await deps.query(`SELECT cm_user_uuid, cm_company_uuid FROM ${table}
+            WHERE cm_user_uuid IN (${ids.map(() => '?').join(', ')}) AND cm_is_active = 1`, ids));
+                const nodes = new Map(ids.map((i) => [i, []]));
+                for (const r of rows) {
+                    if (typeof r.cm_user_uuid !== 'string' || typeof r.cm_company_uuid !== 'string')
+                        continue;
+                    // The stored uuid may differ in case from the page's; match it back to the page id.
+                    const key = ids.find((i) => (0, http_js_1.sameUuid)(i, r.cm_user_uuid));
+                    if (key !== undefined)
+                        nodes.get(key).push(r.cm_company_uuid);
+                }
+                const subjects = ids.map((id) => ({
+                    principalId: id,
+                    isRoot: deps.rootIds.some((r) => (0, http_js_1.sameUuid)(r, id)),
+                    nodeIds: nodes.get(id) ?? [],
+                }));
+                return service.statusesFor(subjects);
+            },
+        };
+    }
+    if (devices) {
+        return {
+            async statusesOf(userIds) {
+                const ids = [...new Set(userIds.filter((i) => typeof i === 'string' && i.length > 0))];
+                if (ids.length === 0)
+                    return new Map();
+                const enrolled = await devices.confirmedFactorsOf(ids);
+                return new Map(ids.map((id) => [id, enrolled.has(id) ? 'enrolled' : 'not_required']));
+            },
+        };
+    }
+    return null;
+}

package/dist/features/user/user-signin-admin.service.d.ts

@@ -0,0 +1,48 @@
+import { RecordsService } from '@astram/engine';
+import type { AuditEvent, FrameworkSchemas, Principal } from '@astram/core';
+import { type SessionSweeper } from '@astram/guard';
+import { type AccountUnlocker, type AdminStepUp, type MfaResetter } from '@astram/guard/internal';
+import { GrantCeiling } from '../authz/grant-ceiling.js';
+/** The three custom actions on `user` (ADR-0038). */
+export type SignInAdminAction = 'reset_mfa' | 'unlock' | 'end_sessions';
+/** The audit writer the Redis/session actions use (autocommit). */
+export interface SignInAdminAuditWriter {
+    record(event: AuditEvent): Promise<void>;
+}
+/** The route body. */
+export interface SignInAdminBody {
+    code?: unknown;
+}
+export declare const AUTH_MFA_RESET_BY_ADMIN = "auth.mfa.reset_by_admin";
+export declare const AUTH_UNLOCKED_BY_ADMIN = "auth.unlocked_by_admin";
+export declare const AUTH_SESSIONS_ENDED = "auth.sessions_ended";
+export declare class UserSignInAdminService {
+    private readonly records;
+    private readonly ceiling;
+    private readonly stepUp?;
+    private readonly unlocker?;
+    private readonly sweeper?;
+    private readonly resetter?;
+    private readonly audit?;
+    private readonly logger;
+    private readonly txAudit;
+    constructor(records: RecordsService, ceiling: GrantCeiling, stepUp?: (AdminStepUp | null) | undefined, unlocker?: (AccountUnlocker | null) | undefined, sweeper?: (SessionSweeper | null) | undefined, resetter?: (MfaResetter | null) | undefined, audit?: (SignInAdminAuditWriter | null) | undefined, schemas?: FrameworkSchemas | null);
+    /** R11.1: delete the user's devices, recovery codes and grace clock; end their sessions. */
+    resetMfa(actor: Principal, uuid: string, body: SignInAdminBody): Promise<{
+        success: true;
+    }>;
+    /** R11.1: clear the user's login, MFA, recovery and CAPTCHA account counters. */
+    unlock(actor: Principal, uuid: string, body: SignInAdminBody): Promise<{
+        success: true;
+    }>;
+    /** R11.1: revoke every session of the user. */
+    endSessions(actor: Principal, uuid: string, body: SignInAdminBody): Promise<{
+        success: true;
+    }>;
+    /** Steps a–e of the class doc. */
+    private gate;
+    /** The audit row after a Redis/session action; a failed write is reported, not hidden. */
+    private recordAfter;
+    private event;
+}
+//# sourceMappingURL=user-signin-admin.service.d.ts.map

package/dist/features/user/user-signin-admin.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-signin-admin.service.d.ts","sourceRoot":"","sources":["../../../src/features/user/user-signin-admin.service.ts"],"names":[],"mappings":"AAuCA,OAAO,EAAoB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5E,OAAO,EAA0B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAMzD,qDAAqD;AACrD,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,QAAQ,GAAG,cAAc,CAAC;AAExE,mEAAmE;AACnE,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,sBAAsB;AACtB,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,eAAO,MAAM,uBAAuB,4BAA4B,CAAC;AACjE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAC/D,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AAoBzD,qBACa,sBAAsB;IAK/B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACkB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAGlE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACkB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IAGrE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IAdzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;gBAGxB,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,YAAY,EACqB,MAAM,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAGrE,QAAQ,CAAC,GAAE,eAAe,GAAG,IAAI,aAAA,EACW,OAAO,CAAC,GAAE,cAAc,GAAG,IAAI,aAAA,EAChC,QAAQ,CAAC,GAAE,WAAW,GAAG,IAAI,aAAA,EAGxE,KAAK,CAAC,GAAE,sBAAsB,GAAG,IAAI,aAAA,EACN,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IAKnF,4FAA4F;IACtF,QAAQ,CACZ,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAkC7B,iFAAiF;IAC3E,MAAM,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAa/F,+CAA+C;IACzC,WAAW,CACf,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,CAAA;KAAE,CAAC;IAa7B,kCAAkC;YACpB,IAAI;IAqClB,0FAA0F;YAC5E,WAAW;IASzB,OAAO,CAAC,KAAK;CAWd"}

package/dist/features/user/user-signin-admin.service.js

@@ -0,0 +1,232 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var UserSignInAdminService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UserSignInAdminService = exports.AUTH_SESSIONS_ENDED = exports.AUTH_UNLOCKED_BY_ADMIN = exports.AUTH_MFA_RESET_BY_ADMIN = void 0;
+/**
+ * Auth capabilities R11.1, R11.2 (task 18, AC-16): admin sign-in controls on one user.
+ *
+ *   POST /identity/users/:uuid/reset-mfa     `identity:user:reset_mfa`
+ *   POST /identity/users/:uuid/unlock        `identity:user:unlock`
+ *   POST /identity/users/:uuid/end-sessions  `identity:user:end_sessions`
+ *   body `{ code }`: the ADMIN's own current TOTP code.
+ *
+ * Order (fail closed, nothing acts before every check passed):
+ *   a. not on yourself (403): your own sign-in is managed under `/account/*` (devices, sessions),
+ *      and an admin route must never be a way around the self-service step-ups;
+ *   b. every port the action needs is wired, else 503 before the code is spent;
+ *   c. step-up (R11.2): the admin's own TOTP on the admin's `mfa:pid` budget through guard's
+ *      replay-guarded verifier (`SHIELD_ADMIN_STEP_UP`). No confirmed device ⇒ 409 `mfa_required`;
+ *      no code ⇒ 400 `mfa_required`; wrong code ⇒ 400 `invalid_request`; budget spent ⇒ 429
+ *      `too_many_requests`; store down ⇒ 503 `authentication_unavailable` (the `/account` step-up
+ *      answers, with 409 for "set up 2FA first");
+ *   d. record-level `authorize('user', uuid, <action>)` (ADR-0038): a user outside the admin's
+ *      scope (another tenant) or a missing grant is the engine's 403;
+ *   e. `GrantCeiling.assertDominates(actor, uuid)` (403, fixed message, no ids);
+ *   f. act, then audit (`admin_action`; actor = admin, tenant = the admin's active tenant, resource
+ *      = the user record, `attributes.userUuid` as the invite row has it):
+ *      - reset-mfa (review round 1, item B): every session is revoked FIRST (sweeper); a sweep
+ *        failure is a 503 with nothing deleted. Then guard's `MariaDbMfaResetter` deletes devices,
+ *        recovery codes and the grace clock and writes `auth.mfa.reset_by_admin` on the SAME
+ *        transaction (runtime pool, the identity tables are not the engine's); a failure there is
+ *        `partially_applied` (sessions ended, 2FA not reset). A closing sweep then ends any session
+ *        signed in with an old device in between; its failure is `partially_applied` too. The user
+ *        re-enrols at next sign-in when a policy requires 2FA (restricted session, R2.3);
+ *      - unlock: guard's unlocker clears `login:pid`, `mfa:pid`, `recovery:` and the CAPTCHA account
+ *        counters (Redis), then `auth.unlocked_by_admin` (autocommit sink);
+ *      - end-sessions: sweeper `revokeAllForPrincipal`, then `auth.sessions_ended` (autocommit).
+ *   Any store error ⇒ 503 with a fixed body. When part of the action was applied but a later step
+ *   failed (reset-mfa: sessions ended but the reset failed, or the closing sweep failed; the audit
+ *   row after a Redis/session action), the 503
+ *   says so: `{ error: 'partially_applied', message }`. Every action is idempotent, so a retry is
+ *   safe.
+ */
+const common_1 = require("@nestjs/common");
+const engine_1 = require("@astram/engine");
+const guard_1 = require("@astram/guard");
+const internal_1 = require("@astram/guard/internal");
+const grant_ceiling_js_1 = require("../authz/grant-ceiling.js");
+const framework_schemas_token_js_1 = require("../framework-schemas.token.js");
+const http_js_1 = require("../shared/http.js");
+const identity_errors_js_1 = require("../shared/identity-errors.js");
+const signin_admin_tokens_js_1 = require("./signin-admin.tokens.js");
+exports.AUTH_MFA_RESET_BY_ADMIN = 'auth.mfa.reset_by_admin';
+exports.AUTH_UNLOCKED_BY_ADMIN = 'auth.unlocked_by_admin';
+exports.AUTH_SESSIONS_ENDED = 'auth.sessions_ended';
+const MSG_SELF = 'Use your account settings to manage your own sign-in.';
+const MSG_UNAVAILABLE = 'This action is temporarily unavailable. Nothing was changed. Try again.';
+const MSG_RESET_NOT_STARTED = "The user's sessions could not be ended, so two-step verification was not reset. Try again.";
+const MSG_RESET_NOT_APPLIED = "The user's sessions were ended, but two-step verification could not be reset. Try again.";
+const MSG_RESET_SESSIONS = "Two-step verification was reset, but the user's sessions could not be ended. Use End sessions to retry.";
+const MSG_NOT_RECORDED = 'The action was applied but could not be recorded. Try again.';
+function httpError(status, error) {
+    throw new common_1.HttpException({ error }, status);
+}
+function partiallyApplied(message) {
+    throw new common_1.HttpException({ error: 'partially_applied', message }, common_1.HttpStatus.SERVICE_UNAVAILABLE);
+}
+let UserSignInAdminService = UserSignInAdminService_1 = class UserSignInAdminService {
+    records;
+    ceiling;
+    stepUp;
+    unlocker;
+    sweeper;
+    resetter;
+    audit;
+    logger = new common_1.Logger(UserSignInAdminService_1.name);
+    txAudit;
+    constructor(records, ceiling, stepUp, unlocker, sweeper, resetter, audit, schemas) {
+        this.records = records;
+        this.ceiling = ceiling;
+        this.stepUp = stepUp;
+        this.unlocker = unlocker;
+        this.sweeper = sweeper;
+        this.resetter = resetter;
+        this.audit = audit;
+        this.txAudit = new engine_1.MariaDbAuditSink(schemas ? { schema: schemas.audit } : {});
+    }
+    /** R11.1: delete the user's devices, recovery codes and grace clock; end their sessions. */
+    async resetMfa(actor, uuid, body) {
+        const resetter = this.resetter;
+        const sweeper = this.sweeper;
+        await this.gate(actor, uuid, 'reset_mfa', body, resetter != null && sweeper != null);
+        // Review round 1, item B: end every session FIRST, so no live session outlasts the reset and a
+        // sweep failure leaves nothing deleted.
+        try {
+            await sweeper.revokeAllForPrincipal(uuid);
+        }
+        catch {
+            this.logger.warn('admin 2FA reset refused: the session sweep failed; nothing was deleted');
+            throw new identity_errors_js_1.IdentityUnavailableError(MSG_RESET_NOT_STARTED);
+        }
+        try {
+            await resetter.reset({
+                principalId: uuid,
+                withinTransaction: (query) => this.txAudit.record(this.event(actor, uuid, exports.AUTH_MFA_RESET_BY_ADMIN), (sql, params) => query(sql, params)),
+            });
+        }
+        catch {
+            this.logger.warn('admin 2FA reset: sessions ended, but the reset could not be applied');
+            partiallyApplied(MSG_RESET_NOT_APPLIED);
+        }
+        // Closing sweep: a sign-in with an old device between the first sweep and the commit.
+        try {
+            await sweeper.revokeAllForPrincipal(uuid);
+        }
+        catch {
+            this.logger.warn('admin 2FA reset applied, but the closing session sweep failed');
+            partiallyApplied(MSG_RESET_SESSIONS);
+        }
+        return { success: true };
+    }
+    /** R11.1: clear the user's login, MFA, recovery and CAPTCHA account counters. */
+    async unlock(actor, uuid, body) {
+        const unlocker = this.unlocker;
+        await this.gate(actor, uuid, 'unlock', body, unlocker != null && this.audit != null);
+        try {
+            await unlocker.unlock(uuid);
+        }
+        catch {
+            this.logger.warn('admin unlock could not clear the counters (store error)');
+            throw new identity_errors_js_1.IdentityUnavailableError(MSG_UNAVAILABLE);
+        }
+        await this.recordAfter(actor, uuid, exports.AUTH_UNLOCKED_BY_ADMIN);
+        return { success: true };
+    }
+    /** R11.1: revoke every session of the user. */
+    async endSessions(actor, uuid, body) {
+        const sweeper = this.sweeper;
+        await this.gate(actor, uuid, 'end_sessions', body, sweeper != null && this.audit != null);
+        try {
+            await sweeper.revokeAllForPrincipal(uuid);
+        }
+        catch {
+            this.logger.warn('admin end-sessions could not revoke the sessions (store error)');
+            throw new identity_errors_js_1.IdentityUnavailableError(MSG_UNAVAILABLE);
+        }
+        await this.recordAfter(actor, uuid, exports.AUTH_SESSIONS_ENDED);
+        return { success: true };
+    }
+    /** Steps a–e of the class doc. */
+    async gate(actor, uuid, action, body, wired) {
+        if ((0, http_js_1.sameUuid)(actor.id, uuid))
+            throw new identity_errors_js_1.IdentityForbiddenError(MSG_SELF);
+        const stepUp = this.stepUp;
+        if (stepUp == null || !wired) {
+            this.logger.warn(`admin sign-in control ${action} refused: a required port is not wired`);
+            throw new identity_errors_js_1.IdentityUnavailableError(MSG_UNAVAILABLE);
+        }
+        const code = typeof body?.code === 'string' ? body.code : '';
+        const outcome = await stepUp.verify(actor.id, code);
+        switch (outcome) {
+            case 'verified':
+                break;
+            case 'no_factor':
+                httpError(common_1.HttpStatus.CONFLICT, 'mfa_required');
+                break;
+            case 'missing':
+                httpError(common_1.HttpStatus.BAD_REQUEST, 'mfa_required');
+                break;
+            case 'rejected':
+                httpError(common_1.HttpStatus.BAD_REQUEST, 'invalid_request');
+                break;
+            case 'locked':
+                httpError(common_1.HttpStatus.TOO_MANY_REQUESTS, 'too_many_requests');
+                break;
+            default:
+                httpError(common_1.HttpStatus.SERVICE_UNAVAILABLE, 'authentication_unavailable');
+        }
+        await this.records.authorize('user', uuid, action);
+        await this.ceiling.assertDominates(actor, uuid);
+    }
+    /** The audit row after a Redis/session action; a failed write is reported, not hidden. */
+    async recordAfter(actor, uuid, key) {
+        try {
+            await this.audit.record(this.event(actor, uuid, key));
+        }
+        catch {
+            this.logger.warn(`${key} applied, but its audit row could not be written`);
+            partiallyApplied(MSG_NOT_RECORDED);
+        }
+    }
+    event(actor, uuid, key) {
+        return {
+            type: 'admin_action',
+            occurredAtMs: Date.now(),
+            actorId: actor.id,
+            tenantId: actor.tenantId,
+            action: { key },
+            resource: { level: 'record', typeKey: 'user', tenantId: actor.tenantId, recordId: uuid },
+            attributes: { userUuid: uuid },
+        };
+    }
+};
+exports.UserSignInAdminService = UserSignInAdminService;
+exports.UserSignInAdminService = UserSignInAdminService = UserSignInAdminService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(2, (0, common_1.Optional)()),
+    __param(2, (0, common_1.Inject)(internal_1.SHIELD_ADMIN_STEP_UP)),
+    __param(3, (0, common_1.Optional)()),
+    __param(3, (0, common_1.Inject)(internal_1.SHIELD_ACCOUNT_UNLOCKER)),
+    __param(4, (0, common_1.Optional)()),
+    __param(4, (0, common_1.Inject)(guard_1.SHIELD_SESSION_SWEEPER)),
+    __param(5, (0, common_1.Optional)()),
+    __param(5, (0, common_1.Inject)(signin_admin_tokens_js_1.IDENTITY_MFA_RESETTER)),
+    __param(6, (0, common_1.Optional)()),
+    __param(6, (0, common_1.Inject)(signin_admin_tokens_js_1.IDENTITY_SIGNIN_ADMIN_AUDIT)),
+    __param(7, (0, common_1.Optional)()),
+    __param(7, (0, common_1.Inject)(framework_schemas_token_js_1.IDENTITY_FRAMEWORK_SCHEMAS)),
+    __metadata("design:paramtypes", [engine_1.RecordsService,
+        grant_ceiling_js_1.GrantCeiling, Object, Object, Object, Object, Object, Object])
+], UserSignInAdminService);

package/dist/features/user/user.controller.d.ts

@@ -1,11 +1,13 @@
 import { UserService } from './user.service.js';
 import { InviteService, type InviteResult } from './invite.service.js';
+import { UserSignInAdminService, type SignInAdminBody } from './user-signin-admin.service.js';
 import { type ListQueryDto } from '../shared/list-query.js';
 import type { AuthedRequest } from '../shared/http.js';
 export declare class UserController {
     private readonly users;
     private readonly invites?;
-    constructor(users: UserService, invites?: InviteService | undefined);
+    private readonly signInAdmin?;
+    constructor(users: UserService, invites?: InviteService | undefined, signInAdmin?: UserSignInAdminService | undefined);
     /**
      * List users — gated on `identity:user:read` (see class doc). Server-side DataTable:
      * `?page&limit&search&sortBy&sortOrder`. Returns `{ total, rows, page, limit }` —
@@ -25,15 +27,20 @@ export declare class UserController {
         username?: string;
         email?: string;
         companyUuid?: string;
+        loginName?: string | null;
     }): Promise<import("./user.service.js").CreateUserResult>;
     /** Read one user — gated on `identity:user:read` (CONTROL-plane; root, the identity
      *  administrator, may read users). */
     getUser(uuid: string): Promise<import("./user.service.js").UserRecord | null>;
-    /** Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` apply. */
+    /**
+     * Update a user — gated on `identity:user:update`. Only `username`, `email`, `status` and
+     * `loginName` (R1.7; `null` clears; needs dominance) apply.
+     */
     updateUser(req: AuthedRequest, uuid: string, body: {
         username?: string;
         email?: string;
         status?: string;
+        loginName?: string | null;
     }): Promise<{
         success: boolean;
     }>;
@@ -44,6 +51,26 @@ export declare class UserController {
      * 409 not locked, 429 throttled, 501 no delivery channel, 503 send failed.
      */
     inviteUser(req: AuthedRequest, uuid: string): Promise<InviteResult>;
+    /**
+     * Auth capabilities R11 (task 18): admin sign-in controls, each a custom action on `user`
+     * (ADR-0038) with the admin's own TOTP in the body `{ code }`, record-level check and dominance in
+     * the service. 200 `{ success: true }`; 400 `{error:'mfa_required'}` no code, 400
+     * `{error:'invalid_request'}` wrong code, 409 `{error:'mfa_required'}` admin has no 2FA, 403 not
+     * allowed (yourself, no grant, other tenant, not dominated), 429 step-up budget, 503 unavailable
+     * (`{error:'partially_applied', message}` when the action was applied but a later step failed).
+     */
+    resetUserMfa(req: AuthedRequest, uuid: string, body: SignInAdminBody): Promise<{
+        success: true;
+    }>;
+    /** R11: clear the user's sign-in lockout counters — `identity:user:unlock` (see above). */
+    unlockUser(req: AuthedRequest, uuid: string, body: SignInAdminBody): Promise<{
+        success: true;
+    }>;
+    /** R11: end every session of the user — `identity:user:end_sessions` (see above). */
+    endUserSessions(req: AuthedRequest, uuid: string, body: SignInAdminBody): Promise<{
+        success: true;
+    }>;
+    private signInAdminService;
     /** Delete a user — gated on `identity:user:delete`; the caller must dominate the user. */
     deleteUser(req: AuthedRequest, uuid: string): Promise<{
         success: boolean;